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ABSTRACT 


While making communication among the wireless nodes, which relies on without making 
infrastructure less network are vulnerable to security fall. One of the most affecting vulnerable security 
falling wireless networks is Mobile Adhoc Network. The most predominant kind of security falls are 
intruders and attackers whose roles are trying to diminish the internal performance of the Network. Many 
research works are concentrating to detect and prevent these two factors. This article concentrates on 
predicting white hole attackers inside the communication or not. White hole attackers is a kind of attacker 
whose role is to send the many duplicate packets to the neighboring node to increase the load of the 
neighbor nodes which affect the overall Mobile Adhoc network performance . Many existing research used 
the latest technique to predict the attackers which are additional overload to the network .To achieve this 
objective the WatchDog method introduces to monitoring the forwarded time of the every nodes present in 
the communication a node which make plenty of times forwarded the packet to the many nodes assumes as 
white hole attackers. The proposed Watchdog Algorithm with Classification Technique was implemented 
with Network simulator and the simulation results are compared with Machine learning based routing 
protocol then the compared results are proved the WatchDog based attacker methods performs well is 
more than 30 % better also the performance factors are excellent in 60%. 

Keywords: MANET, Attackers, White Hole Attackers, WatchDog Technique, Forward time, Threshold 
Value 

1. INTRODUCTION nature MANET was using in many applications like 

disaster management, earth quake, military etc. 


One of the on demanding wireless 
networks for making instant communication 
without support of any basic infrastructure is 
Mobile Adhoc Network (MANET) as shown in the 
Figure 1. This Kind of Networks can easily moved 
instantly to any place and also has an advantage of 
limiting layers in the protocol stack. Due to this 


Many external forces are trying to crumble the 
MANET application usage by creating the 
mitigation on MANET performance factor. One of 
the famous mitigation creations is done when the 
transmission of the packets. Several categories of 
Attackers and Intruders are penetrated in the 
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Network make the mitigation on _ packet related to research work talked in chapter 2, 


transmission. 
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Figure 1 Manet Nodes Architecture 


Many research work was carried out for 
detection and preventing white hole Attackers in 
the MANET by introducing the novel techniques 
like Artificial based [9], Machine learning 
algorithms[21], deep learning algorithms[9] , Data 
analytic method[16], and Fuzzy logic[19] shown in 
the Figure 2 ,but still the MANET is lags on 
security. 


Motivation of the Research work 


The objective of the research work to 
carried out white hole attacker in the MANET 
while making communication. White hole attackers 
are inverse to the black hole attacker; they send 
multiple packets to the neighboring node to make 
the MANET in to disintegrate. The narrow 
research work is needed to classify what kinds of 
attacker are participating in the MANET 
communication. This could be achieved by simple 
monitoring of forwarding time of the each MANET 
node. For instant the node forward time for a 
specific packet is delay , not forwarding selective 
the packet constantly , and not at all forwarding the 
packet or forwarding the packet many times are 
classified in to white hole attacker. 

This research work could be achieving my 
adding WatchDog technique to monitoring the 
forwarding time of each packets on every node 
which participating in the communication. This 
research article is organized as follows: survey 


WatchDog Algorithm and classification techniques 
discussed in chapter 3 studies, proposed research 
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Figure 2 Manet Security Research Classifications 


work simulation work mentioned in chapter 4, and 
conclusion in chapter 5. 


2. LITERATURE SURVEY 


Vijayalakshmi et al. [1] proposed the IDS 
system based on the novel game theory with 
neighbor trust table approach which classifies the 
nodes in to defect node or cooperate node approach 
they achieved packet delivery ratio in 42 %. Set of 
research work was carried out to detect the attack 
using protocol. Hanif et al [2] detect wormhole 
attacker detection in using AI based techniques, 
Teli et al.[3]detect the black hole and gray hole 
attack using mitigating techniques. 

Shankar [4] proposed secured data 
transmission using ZRP protocol to provide better 
QOS while gray whole attack. Hussain etal. [5] 
proposed AI enabled routing protocol for secured 
communication. Khanna and Sachdeva [7] uses a 
taxonomy technique to detect black hole attackers, 
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Sultan, [9] uses deep learning based ANN 
technique to make detection of IDS, Pandey and 
Singh [10] done black hole detection using machine 
learning algorithm , Location aided routing 
techniques proposed by suma et al. [7] for 
attackers in MANET . 

Rajeshkumar et al. [6] uses cluster trust 
adaptive ack , Kalman filtering technique, and 
swarm optimization identify black hole attacker , 
outcome of this research provides 3.33 % 
improvement in PDR and 3.5% improvement in 
male ware detection when comparing with 
CTAAPSO methods. Khaled Ahmed [11] made 
research on jelly fish attack in TCP based MANET, 
jelly fish nodes target the TCP communication 
mechanism. Black hole detection algorithm 
proposed by Olanrewaju et al. [12] Using DHMD 
5 and compute the performance metric which yield 
23% and reduce the memory overhead .Research 
work done by the authors Pushpender Sarao [13] 
for multiple attacks solutions like rushing attack, 
gray hole attack and black hole attack. They 
conclude that above attacks affect the performance 
of the network. Block chain based routing protocol 
proposed by Nitesh Ghodichor [14] to mitigate 
attacks in MANET and the research work achieves 
good improvement in delay. 

SDPEGH algorithm proposed by the 
authors Thabiso Khosa et al.[15], result produced 
90.9% throughput, 89% Packet delivery ratio, and 
5.7% overhead comparing with RSet Theory and 
GA_BFO algorithms. Along with spider monkey 
optimization and swarm Intelligence technique 
proposed by the authors Arunmozhi et al. [16] to 
detect the black hole attackers and proved the result 
performs better performance. Timer Entrenched 
Baited Scheme proposed by the authors 
Padmapriya [17] to locate the attacker and remove 
from the network communication also support 
intelligent dark opening recognition and 
detachment technique in MANET Whale 
Optimized Deep Neural Network Model, Whale 
Optimization Algorithm) and Deep Neural Network 
invented by the authors Edwin Singh and Maria 
Celestin Vigila [ 18] for detecting intruder in 
MANET the simulation result of this work 
produced 99.1% accuracy. S. Fuzzy logic scheme 
based black hole and gray hole attacker detection 
method proposed by the Maheswari and R. 
Vijayabhasker [19] and simulation results achieved 
greater performance improvement. 

Fuzzy based PCA-FELM — scheme 
proposed by the authors Edwin Singh and Maria 
[20] for detecting intruder in MANET; proposed 
work was simulated using MAT LAB and results 


produces 99.08% higher accuracy comparing with 
DBN-IDS, GOA-SVM and SDAE-ELM.ML- 
AODV method proposed by haik Shafi et al. [21] 
for detecting flood and black hole attacks detection 
simulation results achieves throughput reliability 
routing over head and pack loss ratio to 4%, 44%, 
10 to 15 % respectively. Optimal routing algorithm 
proposed by Veeraiah and Krishna [22] providing 
security route path for communication to avoid 
intruder interfere in the communication. Hybrid 
routing multipath algorithm for intruder detection 
proposed by N. Veeraiah et al [23] to provide 
trusty communication between the nodes . Borkar, 
G. M., & Mahajan [24] discuss the different article 
supports secure data communication for prevention 
attack in MANET. Nitesh Ghodichor et al. [25] 
proposed the routing algorithm for against internal 
and external attack prevention in MANET nodes 
communication. 

Research related to malicious nodes 
isolation was done by the authors Thiagarajan et al. 
[26] with secure optimized approach. Clustering 
routing approach for finding routing misbehaviour 
node to indentify the intruder was invented by the 
authors in Nagaraj et al. [27]. AI with Swarm 
algorithm with AI for detecting black hole and gray 
hole attacker proposed by the authors Rani et al. 
[28] .AI technique incorporated in to MANET to 
predict the Black hole attacker for making secure 
communication was proposed by the authors 
Hassan et al. [29]. Kumari et al. [30] invented the 
method for creating black hole attack in AODV 
routing protocol and S. Gurung and S. Chauhan 
[31] discussed the challenges and survey about 
black hole attacks techniques in MANET . Trust 
based techniques were proposed by the authors in 
Goswaalcmi et al. [31] for black hole detection 
technique in MANET. Ant colony approach method 
was discussed in Khan et al [33] for preventing 
black hole attacker in MANET. 


From the literature review many authors 
uses the different techniques like AI _ based, 
machine learning based, clustered based, block 
chain based and even the trust based methods for 
preventing and detecting black hole , gray hole and 
warm hole attacker. Still the research work is more 
focusing on the MANET to provide solution for 
preventing such an attacker in MANET. 


3. RESEARCH METHODS 


MANET nodes are vulnerable to much 
kind of attacks which could be done by the internal 
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nodes which are taking part of communication. The 
research methods focuses on MANET node 
forming to find out the attackers are present in the 
communication or not .Assuming MANET is a 
Graph which has vertices and Edges are connected 
in undirected graph. 

Let us Assume Graph G (V, E), 

Vertices represent the total number of nodes are in 
the MANET. 

Let's say V= {nl1, n2, n3....Nn} 

Edges are connecting n number of nodes 

The transmission range of N nodes are two 
dimensions metric of N 

Let Assume Source node S wants to send Data P to 
the Destination node D. 

The data is collection of packets named as Pi = 
{P1, P2, and P3.....Pm}. 

Every packet pass several intermediate node to 
reach to the destination. 

Let have Collection of intermediate nodes from S to 
D= {11, 12, 13 ...In} 

WatchDog technique used for monitor the 
every node activity forwarded time. This estimated 
forwarded time only support for classifying the 
node is white hole attacker . Every node forwarded 
time is calculated from the equation 


Se 
t=1 


Where tt is the Transmission time of the all packets 
Pi of every nodes. 

The time taken for a packet reach to the 
destination is computed with the principle of time 
of flight. A threshold value & is determined, when 
the Forwarded time below the threshold value them 
conclude the nodes is normal, otherwise classify the 
nodes in to attacker category or normal node 
category. The distance between the sources to 
destination is calculated using time of flight. This is 
done with the support of beacon signal generation 
for route Request (RREQ) and Route Reply 
(RREP). Two category of beacon signal named as 
Beacon signal arrival time Ba , Beacon signal 
Transmission time Bx. the difference between this 
two times is called distance from Source to 
Destination d. 

d=( Bat - Btt ) (Eq2) 
Source Node RREQ —Intermediate Node 
— Destination Node ( Eq 3) 
Destination Node RREP —Intermediate Node 

RREP —Source Node ( Eq 4) 

To differentiate malicious and normal node along 
with the route path 
Malicious Node where Ft > threshold value 6 


( Eqs) 


Forward Time Ft = (Fg1) 


Normal Node where Ft < threshold value 6 
(Eq 6) 


Algorithm 1 
The algorithm for determine the WatchDog role 
as follows 
1. Let S be the source node and D be the 
destination node 
2. Using AODV routing algorithm determines the 
path between the source to destination using RREQ 
and RREP procedure. 
3. Collect the All the intermediate nodes and 
forward time and time of flight using the forward to 
the WatchDog classification, 
4. WatchDog perform the comparison using the Eq 
1 to 6. 
5. If any malicious node detected call classification 
technique 
6. Alert malicious node 
7. Start finding new path and forwarding the 
packets 


Keep Watching 
the threshold 
value 


Figure 3 Watchdog And Classification Technique Flow 
Chart 


Classification technique (Malicious Node) 


SS 


//Here the classification of malicious node in to 
White hole attacker or a normal node 
If (Forward time > threshold Value) 


Check forward time for all the packets form the 
malicious node 
if (selective packet forward time varies) 
return Node M is a normal node 
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Elseif (More forward time computing for 
the same packet) 
Node M is a White hole attacker 
else M is a normal node 


ij 


return M 


rj 


WatchDog algorithm stages define in the 
Algorithm 1 and working flow chart shown in the 
Figure 3. First few stages the route selection is done 
using the traditional routing technique of route 
request and reply. This algorithm uses on demand 
AODV protocol for finding the best path since it is 
on demand does not require any route overhead. 
After the reliable route is selected then the 
calculation of Forward time for the entire 
intermediate route (which include the source node 
as well as destination node) and time to flight is 
done. This information is forwarded to the 
WatchDog for processing the nodes and find out 
any attacker present in the route. All the 
computation is done once the variation of the 
threshold vales detected. 


When the threshold values varies 
suspected node forward to the classification 
function where the nodes will be finalized it is a 
normal node or an attacker. Classification function 
is established to check the forwarded time of the 
malicious node.Forwarded time is not computed for 
a specific packet then the node is a malicious node, 
or the forwarded time not computed for the 
randomly selective packet then the node is more 
than one forward time is estimated for the single 
packet then the node is a white hole attacker since 
which try to flood the packet to many nodes. 


4. SIMULATION RESULT 


Simulation of WatchDog technique based 
White hole attacker classification is named as 
WDWHA model (WDWHA -AODV) which is 
simulated using Network simulator 2.34. Table 1 
for metric value defined used for simulation. 
Defined Network area is 1000 m* 1000m and 
nodes are varying ranges from 50, 100, and 150 and 
so on up to 300. Simulation time 300 sec and 
random mobility among the nodes are set .Speed of 
the mobility node is maximum 25 ms, and protocol 
used for route selection is AODV. 

Figure 4 depict stages to carry out the 
proposed model in the simulation. Well defined 
system model done from the chapter 3, outcome of 


the system model with the WatchDog algorithm 
and simulation set up pass to the NS 2.34.Simulator 
done the classification of the nodes, in to the 
normal or malicious node. Malicious node is 
forwarded to the classification, classifier detect that 
malicious is a normal node or white hole attacker 
.Data set receive from the simulation are plotted as 
a graph by comparing with ML-AODV [7] 
protocol. Finally conclude the proposed work 
outcomes. 


Table 1 Metric Value Used For Simulation 


Metric Value 
Network simulator NS 2.34 
Protocol selected AODV 
Number of nodes 50,100,150, 200,250,300 
Simulation time 300 sec 
Model of mobility Random 
Speed of node 0-25 m/s 
Network area 1000m * 1000 m 
Initial sending Data 10,20,30,40,50, 60, 70 
packets 
Traffic Constant Bit rate 


Classification Comparson Graph 


Inder 


Atarkor | Protoflmaion 


Figure 4 Proposed Model Simulation Stage 


Initially, the proposed work will be work 
by setting the source node and destination node 
.when the simulation starts running the Route 
Request is send from the source to reach to 
destination, destination node send route reply. This 
makes the route path between the sources to the 
destination. Second stage the Source send the 
packet one by one parallel the WatchDog start 
collecting the forwarded time of the all 
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intermediate node, when the threshold level greater 
the forwarded time then classification function 
invoked to classify the node is a normal node or 
white hole attacker. Finally the MANET malicious 
node are alert in to the MANET , and find a new 
route part then start transmitting of the packets as 
new. 

The data received from the NS 2.34 node 
ID, data send, transmission time, Data received, 
types of attack nodes. ML-AODV protocol without 
WatchDog and classification algorithm values are 
taken for the performance comparison. 
Attack Rate Comparison 

Attack rate is computed as a ratio between 
the total number of nodes currently detected as a 
normal or malicious with total number of nodes in 
percentage. Simulation result shows high attack rate 
when the proposed work is more efficient. The data 
collected from the simulation is shown the 
comparisons result in pictorial representation is 
depicted in the Figure 5, the results proven that 
proposed AODV with WDWHA -AODV model 
works 30 percent than existing ML-AODV. 


Total number of normal or malicious node 


Attack Detection = —————————— ¥ 100 


Number of Nodes (4) 


Attack Rate 


Bm ML-AODV 


Attack Ratio 


lm WOWHA-AODV 


1 2 3 4 5 6 


Total Nodes 


Figure 5 Attack Rate 


Attack Detection Time 


This is the measurement time taken for 
identification of first malicious node. 
ADT = n* t (Detecting First Malicious Node) 


Where n is the total node and t is time taken for 
detecting first malicious node. 


Simulation result lesser attack detection 
method is efficient. The ML-AODV without 
WDWHA -AODV model detect the attacker in 0. 
3ms where proposed AODV WDWHA -AODV 
model detect the attacker in 0.2 ms. which exhibit 
that proposed WDWHA -AODV model comparing 
with AODV good in 25% performance. The Figure 
6 depicted the simulation value received and 
comparison graph plotted between the estimated 
values which shows that proposed WDWHA - 
AODV model attacker detection time is less 0.4m/s 
of traditional ML-AODV 0.7m/s. 


Attack Detection Time 


= ML-AODV 


Detection time 


® WDWHA-AODV 


1 2 3 4 5 


Total nodes 


Figure 6 Attack Detection Time 


Packet Delivery Ratio 


The Packet Delivery Ratio is a ration between the 
numbers of packet received from the sender with 
number of packet send, 


Totalnumber of Data packet received 
Total numebr of Date Packet Send 


Initially the packet are started send is set 
from 10,and slowly increasing by 
20,30,40,50,60,70, The dropped packet are listed in 
the comparison chart shown in the Figure 7 , in 
which the proposed WDWHA -AODV model 
packet delivery ratio is high ranging from 70 % to 
84% where as traditional Packet Delivery ratio is 
60% to 70% . 
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Packet Delivery Ratio 
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Figure 7 Packet Delivery Ratio 


End to End Delay 


End to End Delay 
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Figure 8 End To End Delay 


End to End delay estimated as the time difference 
between packet send from the source to packet 
arrival at destination. Packet send from the sender 
side delay is Oms but there is varies delay at the 
destination node which is shown in the Figure 8 
shows the comparison chart of delay between the 
traditional ML-AODV and Proposed WDWHA - 
AODVT model where the proposed model delay is 
less varies from 6.2% to 43.4%. 


5. CONCLUSION 


This article focuses on detecting White 
hole attackers are present in the communication of 
the MANET routing. This is achieved by 
introducing the WatchDog Algorithm and 
classification technique based on the forward time 


and threshold value. The outcome of the research 
out whether the malicious node is a normal node or 
white hole attacker. Simulation of the proposed 
work done with NS2.34 and the revealed result are 
computed with the metric of attack rate, attack 
detection time, packet delivery ratio and End to End 
Delay. Simulation result in all the factors the 
proposed methods proved best result overall 
MANET metric value are increased to 30 % better 
also the performance factors are excellent in 60%. 
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